CVE-2026-3359 Overview
CVE-2026-3359 is a SQL injection vulnerability affecting the Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress. The flaw exists in versions up to and including 1.15.42. The plugin fails to properly escape the inputs parameter and does not sufficiently prepare the resulting SQL query. Unauthenticated attackers can append additional SQL queries to the existing query and extract sensitive data from the WordPress database. The vulnerability is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).
Critical Impact
Unauthenticated remote attackers can extract sensitive database contents, including user credentials and session data, from any WordPress site running a vulnerable Form Maker plugin version.
Affected Products
- Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder for WordPress
- All plugin versions up to and including 1.15.42
- WordPress sites with the plugin active and reachable over the network
Discovery Timeline
- 2026-05-05 - CVE-2026-3359 published to NVD
- 2026-05-05 - Last updated in NVD database
Technical Details for CVE-2026-3359
Vulnerability Analysis
The Form Maker plugin processes form submissions through a handler that accepts an inputs parameter from the client. The parameter value is concatenated into a SQL statement without parameterized binding or adequate escaping. An attacker can submit a crafted inputs value to break out of the intended query context and append arbitrary SQL clauses.
Because the endpoint does not require authentication, exploitation works against any reachable WordPress site running a vulnerable plugin version. Attackers typically use UNION-based or time-based techniques to read data such as wp_users records, password hashes, session tokens stored in wp_usermeta, and plugin configuration values.
Root Cause
The root cause is insufficient neutralization of user input in a SQL query. The plugin code path that handles the inputs parameter omits the WordPress $wpdb->prepare() placeholder mechanism and does not apply esc_sql() consistently. This pattern matches CWE-89 and was corrected in the patch published as WordPress plugin changeset 3518461.
Attack Vector
The attack vector is network-based and requires no authentication or user interaction. An attacker sends an HTTP POST request to the plugin's form submission endpoint with a malicious inputs parameter. The injected SQL executes within the database context used by WordPress, enabling read access to any table reachable by the WordPress database user. Refer to the Wordfence vulnerability report for technical analysis.
Detection Methods for CVE-2026-3359
Indicators of Compromise
- HTTP requests to Form Maker submission endpoints containing SQL syntax in the inputs parameter, such as UNION SELECT, SLEEP(, BENCHMARK(, or comment sequences -- and /*
- Unusually long response times on form submission endpoints, indicating time-based blind SQL injection
- Unexpected database errors logged by WordPress or the underlying MySQL or MariaDB instance
- New or unknown administrator accounts in wp_users after suspicious form submissions
Detection Strategies
- Inspect web server access logs for POST requests to Form Maker action endpoints with encoded SQL keywords in the inputs field
- Deploy a web application firewall rule that blocks SQL metacharacters in plugin parameters not expected to contain them
- Enable MySQL general query logging in staging to baseline legitimate Form Maker queries and alert on deviations
Monitoring Recommendations
- Forward WordPress, web server, and database logs to a centralized analytics platform for correlation across the request and query layers
- Alert on outbound traffic from the WordPress host to unfamiliar destinations, which may indicate exfiltration following exploitation
- Monitor file integrity on wp-content/plugins/form-maker/ to detect tampering or webshell placement
How to Mitigate CVE-2026-3359
Immediate Actions Required
- Update the Form Maker by 10Web plugin to the version released after 1.15.42 that includes changeset 3518461
- If immediate patching is not possible, deactivate and remove the plugin until a fixed version can be installed
- Rotate WordPress administrator passwords and invalidate active sessions if exploitation is suspected
- Review the wp_users and wp_options tables for unauthorized changes
Patch Information
The vendor addressed the issue in the WordPress plugin repository under changeset 3518461. The fix introduces parameterized queries using $wpdb->prepare() for the inputs parameter handler. Site administrators should apply the update through the WordPress admin dashboard or via WP-CLI.
Workarounds
- Restrict access to Form Maker submission URLs using a web application firewall rule that filters SQL metacharacters in the inputs parameter
- Limit the WordPress database user to the minimum privileges required, denying access to tables outside the WordPress schema
- Place the WordPress site behind an authenticating reverse proxy if forms are intended for internal use only
# Update the plugin using WP-CLI
wp plugin update form-maker
# Verify the installed version
wp plugin get form-maker --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
